Vulnerabilities > CVE-2022-30359 - Insecure Storage of Sensitive Information vulnerability in Ovaledge

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

LOW

Integrity impact

NONE

Availability impact

NONE

network

low complexity

ovaledge

CWE-922

NVD

Published: 2024-10-25

Updated: 2024-10-31

Summary

OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserList. Authentication is required. The information disclosed is associated with the all registered users, including user ID, status, email address, role(s), user type, license type, and personal details such as first name, last name, gender, and user preferences.

Vulnerable Configurations

Part	Description	Count
Application	Ovaledge Ovaledge Ovaledge - Ovaledge Ovaledge 5.0 Ovaledge Ovaledge 5.0.5 Ovaledge Ovaledge 5.0.7 Ovaledge Ovaledge 5.0.8 Ovaledge Ovaledge 5.0.9 Ovaledge Ovaledge 5.0.10 Ovaledge Ovaledge 5.1 Ovaledge Ovaledge 5.1.1 Ovaledge Ovaledge 5.1.2 Ovaledge Ovaledge 5.1.3 Ovaledge Ovaledge 5.1.4 Ovaledge Ovaledge 5.1.5 Ovaledge Ovaledge 5.1.6 Ovaledge Ovaledge 5.1.7 Ovaledge Ovaledge 5.1.8 Ovaledge Ovaledge 5.1.9 Ovaledge Ovaledge 5.2 Ovaledge Ovaledge 5.2.1 Ovaledge Ovaledge 5.2.2 Ovaledge Ovaledge 5.2.3 Ovaledge Ovaledge 5.2.4 Ovaledge Ovaledge 5.2.5 Ovaledge Ovaledge 5.2.6 Ovaledge Ovaledge 5.2.7 Ovaledge Ovaledge 5.2.8	26

Common Weakness Enumeration (CWE)

CWE-922 - Insecure Storage of Sensitive Information

References

https://cve.offsecguy.com/ovaledge/vulnerabilities/sensitive-data-exposure#cve-2022-30359